Knowledge base · TOPIC-13

Fake-IP DNS: synthetic address or real failure?

Short answer: a synthetic DNS answer may be an intentional local mapping. The address alone is not evidence of a DNS leak, successful routing, or a broken AI service.

Some local network layers return a reserved or synthetic address and maintain a separate mapping to the destination. To evaluate the result, you need the resolver context, subsequent route, certificate identity, and connection outcome. A successful certificate-validated TLS session can show that the mapped path reached the intended name; it still does not reveal every internal routing decision.

Do not publish local configuration, subscription data, credentials, or private addresses while investigating. Compare a bounded lookup and TLS result, then document whether the behavior is expected in your environment. Avoid changing DNS architecture merely because a third-party detector labels a reserved range unusual.

Tivor Open Probe V0.1 records bounded local DNS and connection evidence, but does not read proxy/TUN configuration, identify a product, or diagnose a Fake-IP implementation. Use the Scanner for browser evidence and Open Probe when local context matters. Related: captive portal versus provider failure.